Bug 702407 – Gnumeric segfaults in workbook_sheet_attach

After an evaluation, GNOME has moved from Bugzilla to GitLab. Learn more about GitLab.
No new issues can be reported in GNOME Bugzilla anymore.
To report an issue in a GNOME project, go to GNOME GitLab.
Do not go to GNOME Gitlab for: Bluefish, Doxygen, GnuCash, GStreamer, java-gnome, LDTP, NetworkManager, Tomboy.

Bug 702407 - Gnumeric segfaults in workbook_sheet_attach


Summary:	Gnumeric segfaults in workbook_sheet_attach


Status:	RESOLVED FIXED

Product:	Gnumeric
Classification:	Applications
Component:	import/export MS Excel (tm)
Version:	git master
Hardware:	Other Linux

Importance:	Normal critical
Target Milestone:	---
Assigned To:	Jody Goldberg
QA Contact:	Jody Goldberg

URL:
Whiteboard:

Depends on:
Blocks:

Reported:	2013-06-16 18:00 UTC by jutaky
Modified:	2013-06-16 22:36 UTC

See Also:
GNOME target:	---
GNOME version:	---

Description jutaky 2013-06-16 18:00:49 UTC

Gnumeric segfaults in workbook_sheet_attach.

Git versions of glib, goffice, gnumeric, libgsf and libxml2.

One of the samples I collected for fuzzing and the sample itself crashes Gnumeric.

Test case: http://www.scielosp.org/avaliacao/Journal_selection_form2012.xlsx

Program received signal SIGSEGV, Segmentation fault.
0x00007ffff79d109e in workbook_sheet_attach (wb=0x0, new_sheet=0x0) at workbook.c:990
990		workbook_sheet_attach_at_pos (wb, new_sheet, wb->sheets->len);
(gdb) bt

+ Trace 232074

#0 workbook_sheet_attach
at workbook.c line 990
#1 xlsx_read_external_sheetname
at xlsx-read.c line 3377
#2 push_child
at gsf-libxml.c line 648
#3 lookup_child
at gsf-libxml.c line 684
#4 gsf_xml_in_start_element
at gsf-libxml.c line 758
#5 xmlParseStartTag__internal_alias
at parser.c line 8612
#6 xmlParseElement__internal_alias
at parser.c line 9975
#7 xmlParseContent__internal_alias
at parser.c line 9885
#8 xmlParseElement__internal_alias
at parser.c line 10058
#9 xmlParseContent__internal_alias
at parser.c line 9885
#10 xmlParseElement__internal_alias
at parser.c line 10058
#11 xmlParseContent__internal_alias
at parser.c line 9885
#12 xmlParseElement__internal_alias
at parser.c line 10058
#13 xmlParseDocument__internal_alias
at parser.c line 10742
#14 gsf_xml_in_doc_parse
at gsf-libxml.c line 1280
#15 gsf_open_pkg_parse_rel_by_id
at gsf-open-pkg-utils.c line 418
#16 xlsx_parse_rel_by_id
at xlsx-read.c line 369
#17 xlsx_wb_external_ref
at xlsx-read.c line 3407
#18 push_child
at gsf-libxml.c line 648
#19 lookup_child
at gsf-libxml.c line 684
#20 gsf_xml_in_start_element
at gsf-libxml.c line 758
#21 xmlParseStartTag__internal_alias
at parser.c line 8612
#22 xmlParseElement__internal_alias
at parser.c line 9975
#23 xmlParseContent__internal_alias
at parser.c line 9885
#24 xmlParseElement__internal_alias
at parser.c line 10058
#25 xmlParseContent__internal_alias
at parser.c line 9885
#26 xmlParseElement__internal_alias
at parser.c line 10058
#27 xmlParseDocument__internal_alias
at parser.c line 10742
#28 gsf_xml_in_doc_parse
at gsf-libxml.c line 1280
#29 xlsx_parse_stream
at xlsx-read.c line 344
#30 xlsx_file_open
at xlsx-read.c line 4779
#31 go_plugin_loader_module_func_file_open
at app/go-plugin-loader-module.c line 282
#32 go_plugin_file_opener_open
at app/go-plugin-service.c line 685
#33 go_file_opener_open
at app/file.c line 417
#34 workbook_view_new_from_input
at workbook-view.c line 1272
#35 workbook_view_new_from_uri
at workbook-view.c line 1332
#36 main
at main-application.c line 321


--
Juha Kylmänen
Research Assistant, OUSPG

Comment 1 Andreas J. Guelzow 2013-06-16 22:36:03 UTC

This problem has been fixed in the development version. The fix will be available in the next major software release. Thank you for your bug report.